CAPA and Complaint Handling for Medical Devices: Process and Root Cause

Corrective and preventive action (CAPA) and complaint handling are the quality system’s immune response. They are also two of the first places an auditor or FDA investigator looks, because they show whether a company actually learns from problems. This guide walks through a clear process: how to receive and assess complaints, decide reportability, find real root causes, and prove your actions worked.

How complaints and CAPA relate

A complaint is any written, electronic or oral communication alleging a deficiency in the identity, quality, durability, reliability, usability, safety or performance of a device after it has been released for distribution. Complaints are a main input to CAPA, along with audits, nonconforming product, trend data, service records and PMS findings. Not every complaint needs a CAPA, but every complaint needs an evaluation and a documented decision.

ISO 13485:2016 covers complaints in clause 8.2.2, corrective action in clause 8.5.2 and preventive action in clause 8.5.3. FDA’s QMSR, effective 2 February 2026, incorporates ISO 13485, with FDA’s own record requirements retained. See our QMSR checklist for how the old CAPA and complaint subsystems map to the new structure.

The complaint handling process

1. Receive and record. Capture every complaint, from any source (customers, distributors, sales, service, social and online channels), with a unique ID and date of awareness.
2. Triage. Decide quickly whether there is a possible patient or user harm, a possible reportable event or a trend.
3. Assess reportability. Evaluate against the rules in each market. In the US, Medical Device Reporting under 21 CFR Part 803 covers deaths, serious injuries and certain malfunctions. In the EU, serious incidents are reported under MDR Article 87. Document the decision even when no report is required.
4. Investigate. Retrieve the device if possible, review manufacturing and design records, and test. If you do not investigate, record the reason.
5. Close with a conclusion. State what was found, any actions taken and the communication to the complainant.
6. Trend. Analyse complaint rates by product, failure mode, site and time, and feed results to risk management and post-market surveillance.

The CAPA process

Step	What good looks like
1. Initiate	Clear problem statement with evidence, scope, product and risk rating; defined criteria for when a CAPA is required
2. Contain	Immediate correction and containment of affected product, with risk assessment of what is already in the field
3. Root cause	Structured investigation using methods such as 5 Whys, fishbone diagrams, fault tree analysis or process mapping, supported by data
4. Action plan	Corrective actions that remove the cause, preventive actions for similar processes, owners and dates
5. Implement	Changes made under change control, with validation or verification where needed
6. Verify effectiveness	Objective evidence over a defined period that the problem has not recurred and no new problem was introduced
7. Close and review	Approved closure and inclusion in management review

Getting to a real root cause

Weak CAPAs usually stop at “operator error” or “retrain staff”. Ask why the error was possible: unclear instructions, a poor design feature, missing poka-yoke, inadequate validation, supplier variation or workload. Test the root cause. If you fix it, would the failure stop? Is there data that supports that? Link the finding to the risk management file and consider whether the design needs a change under design controls. Real-world examples appear in our ISO 14971 case studies.

Effectiveness checks that mean something

• Define the success criterion before you implement: for example no recurrence in 100 consecutive lots, or a complaint rate below a stated level for six months.
• Use data that can actually show recurrence, not a signature that the work was done.
• Re-open the CAPA if the problem returns.
• Where a process was changed, confirm it is still within its validated state.

Common findings and how to avoid them

• CAPAs opened for everything, which buries the important ones. Use risk-based entry criteria.
• CAPAs open for years with repeated extensions.
• No evidence for effectiveness, or a check performed too early to be meaningful.
• Complaints closed as “no product returned” with no further analysis.
• Reportability decisions undocumented or made after the deadline.
• No link between trending and management review.
• Poor handling of complaints received through distributors.

Software that holds these records must itself be validated; see computer software validation.

Frequently asked questions

Does every complaint need a CAPA?

No. Each complaint needs evaluation and a documented decision. A CAPA is warranted when the investigation shows a systemic cause, a trend, a significant risk or a regulatory impact, according to your procedure.

What is the difference between correction, corrective action and preventive action?

A correction fixes the specific problem, such as reworking a unit. A corrective action addresses the root cause to prevent recurrence. A preventive action addresses a potential problem before it happens.

How soon must complaints be evaluated?

There is no single universal number of days for evaluation, but reporting clocks start when you become aware of a potentially reportable event, so triage must be prompt. Define timelines in your procedure.

How long do I keep complaint and CAPA records?

At least for the lifetime of the device as defined by your company, and not less than the period set by applicable regulation, commonly at least two years from release in the US and longer in some markets. Confirm in the regulations that apply to you.

Reporting timelines and record retention periods differ by market and change over time. Confirm against current regulations.

Talk to the AptSkill team

Need CAPA templates or training for your quality team? Send us a message.